Sanae BEKKAR – My Blog –

In today’s interconnected enterprise landscape, secure integration with external APIs and services become essential.

With Oracle Integration Cloud (OIC) , you have a robust platform to connect systems, but when it comes to authentication, many developers and architects face challenges implementing OAuth 2.0 correctly and efficiently.

This two-part blog series is designed to bridge the gap between theory and practice.

In this first part , I’ll share lessons learned from actual projects, highlight best practices, and provide practical advice you can apply immediately.

Let’s start ! First, I’ll cover some definitions to set the stage.

What is OAuth 2.0?

OAuth 2.0 is a standard authorization framework that allows client applications to securely access resources on behalf of a user or service, without exposing user credentials.

The authorization server issues access tokens to the client application, with the user’s consent, which are then used to access resources on the resource server.

Tokens are typically scoped and time-limited. Main actors include the resource owner (user), client (e.g., web/mobile app), authorization server  and resource server.

Most real-world implementations involve either the three-legged flow (user, client, and auth server) or the two-legged flow (client and auth server only).

Here some additional resources for self-study :

OAuth Introduction: https://www.youtube.com/watch?v=zEysfgIbqlg

OAuth Grant Types: https://www.youtube.com/watch?v=1ZX7554l8hY 

Why is it used for OIC ?

It’s widely used for enabling secure integrations between systems , when external applications need to interact with Oracle Integration Cloud (OIC) APIs.

When configuring OIC for OAuth2-based access, it’s important to ensure that the Oracle Identity Cloud Service (IDCS) application associated with your OIC instance is correctly set up.

This involves an administrator explicitly enabling and configuring the appropriate OAuth2 grant types (such as client credentials, authorization code, or refresh token flows), depending on the needs of the client application.

To configure OAuth 2.0 authentication in Oracle Integration Cloud (OIC) using Oracle Identity Cloud Service (IDCS), here are some official Oracle documentation resources:

1. Adding a Confidential Application in IDCS: This guide provides step-by-step instructions on registering a confidential application in IDCS, which is essential for OAuth 2.0 authentication.
   • Add a Confidential Application – Oracle Help Center
2. Configuring OAuth 2.0 Authentication Using Client Credentials: This document details how to configure OAuth 2.0 authentication in OIC using the client credentials grant type.
   • Configure OAuth 2.0 Authentication Using Client Credentials
3. Using OAuth 2.0 Grants in Oracle Identity Cloud Service Environments: This resource explains how to use various OAuth 2.0 grant types within IDCS environments.
   • Use OAuth 2.0 Grants in Oracle Identity Cloud Service Environments
4. OAuth Authentication in Oracle Integration: This page provides an overview of OAuth authentication within Oracle Integration, including authorization flows and token usage.
   • OAuth Authentication in Oracle Integration

These resources should guide you through the process of setting up OAuth 2.0 authentication in your Oracle Integration Cloud environment.

Why You Should Stop Using Basic Authentication in Your Integrations?

At a last Oracle Cloud World 2024 event, a critical point was raised, the one that many integration teams have learned : basic authentication doesn’t scale.

• The Real-World Problem

When customers start building integrations for the systems , they use  basic authentication by default. At first, everything work fine. But with time , they hit a wall. But why?

With basic authentication, every API call triggers a complete login check. Over time, this puts serious strain on identity systems like IDCS, especially in high-traffic environments.

• The consequence ?

A batch of HTTP 429 errors — “Too Many Requests.”

The services themselves remained operational , but the IDCS authentication engine  throttle incoming requests, enforcing rate limits as a protective measure against overload.

What need to be done to fix It?

To resolve this, two critical changes are recommended to do:

1. Migrate the authentication model to OAuth 2.0, moving away from basic auth . This allowed tokens to be reused efficiently without flooding the IDCS engine with repeated login requests.
2. Upgrade the domain configuration, from a standard service level to an enterprise grade capacity, by creating a new domain and migrate apps and/or configurations . This give : Concurrency handling ; Throughput of token-based authentication ; User and group management limits ; MFA and federation scaling. Here an additional resource : https://www.oracle.com/a/ocom/docs/security/what-oci-iam-customers-should-expect.pdf?utm_source=chatgpt.com

Some recommendations

If you’re still using basic authentication in your OIC integrations or SaaS connectivity:

• Stop immediately for production-grade environments.
• Use OAuth for scalable and secure token-based access.
• Monitor for HTTP 429 responses, they’re a red flag that you’re hitting service limits.
• Think about your authentication traffic just as you think about data flow.

Authentication is not just a security concern, it’s a performance concern.

What’s next?

In this first part, you explored OAuth 2.0 in the context of Oracle Integration Cloud (OIC) with some insights shared , based on actual integration challenges faced in production environments. Understanding the roles, token flows, and security considerations is crucial before diving into implementation.

In Part 2, I’ll build on this foundation by walking through a concrete OAuth 2.0 implementation in OIC. You’ll see how to configure connections, apply the right security policies, and integrate with real OAuth provider.

If you’ve encountered roadblocks with OAuth in OIC, Part 2 will help you get past them.